Table Of Content

LITTLE, BROWN AND COMPANY New York Boston London For my mother and grandmother —K.D.M. For Arynne, Victoria, and David, Sheldon, Vincent, and Elena Rose and especially for Charlotte —W.L.S. FOREWORD I met Kevin Mitnick for the first time in 2001, during the filming of a Discovery Channel documentary called The History of Hacking, and we continued the contact. Two years later, I flew to Pittsburgh to introduce him for a talk he was giving at Carnegie Mellon University, where I was dumbfounded to hear his hacking history. He broke into corporate computers but didn’t destroy files, and he didn’t use or sell credit card numbers he had access to. He took software but never sold any of it. He was hacking just for the fun of it, just for the challenge. In his speech, Kevin spelled out in detail the incredible story of how he had cracked the case of the FBI operation against him. Kevin penetrated the whole operation, discovering that a new hacker “friend” was really an FBI snitch, learning the names and home addresses of the entire FBI team working his case, even listening in on the phone calls and voicemails of people trying to gather evidence against him. An alarm system he had set up alerted him when the FBI was preparing to raid him. When the producers of the TV show Screen Savers invited Kevin and me to host an episode, they asked me to demonstrate a new electronic device that was just then coming onto the consumer market: the GPS. I was supposed to drive around while they tracked my car. On the air, they displayed a map of the seemingly random route I had driven. It spelled out a message: FREE KEVIN We shared the microphones again in 2006, when Kevin was the stand-in host of Art Bell’s talk show Coast to Coast AM and invited me to join him as his on-air guest. By then I had heard a lot of his story; that night he interviewed me about mine and we shared many laughs, as we usually do when we’re together. My life has been changed by Kevin. One day I realized that I was getting his phone calls from faraway places: he was in Russia to give a speech, in Spain to help a company with security issues, in Chile to advise a bank that had had a computer break-in. It sounded pretty cool. I hadn’t used my passport in about ten years until those phone calls gave me an itch. Kevin put me in touch with the agent who books his speeches. She told me, “I can get speaking engagements for you, too.” So thanks to Kevin, I’ve become an international traveler like him. Kevin has become one of my best friends. I love being around him, hearing the stories about his exploits and adventures. He has lived a life as exciting and gripping as the best caper movies. Now you’ll be able to share all these stories that I have heard one by one, now and then through the years. In a way, I envy the experience of the journey you’re about to start, as you absorb the incredible, almost unbelievable tale of Kevin Mitnick’s life and exploits. —Steve Wozniak, cofounder, Apple, Inc. PROLOGUE P hysical entry”: slipping into a building of your target company. It’s something I never like to do. Way too risky. Just writing about it makes me practically break out in a cold sweat. But there I was, lurking in the dark parking lot of a billion-dollar company on a warm evening in spring, watching for my opportunity. A week earlier I had paid a visit to this building in broad daylight, on the pretext of dropping off a letter to an employee. The real reason was so I could get a good look at their ID cards. This company put the employee’s head shot upper left, name just below that, last name first, in block letters. The name of the company was at the bottom of the card, in red, also in block letters. I had gone to Kinko’s and looked up the company’s website, so I could download and copy an image of the company logo. With that and a scanned copy of my own photo, it took me about twenty minutes working in Photoshop to make up and print out a reasonable facsimile of a company ID card, which I sealed into a dime-store plastic holder. I crafted another phony ID for a friend who had agreed to go along with me in case I needed him. Here’s a news flash: it doesn’t even have to be all that authentic looking. Ninety-nine percent of the time, it won’t get more than a glance. As long as the essential elements are in the right place and look more or less the way they are supposed to, you can get by with it… unless, of course, some overzealous guard or an employee who likes to play the role of security watchdog insists on taking a close look. It’s a danger you run when you live a life like mine. In the parking lot, I stay out of sight, watching the glow of cigarettes from the stream of people stepping out for a smoke break. Finally I spot a little pack of five or six people starting back into the building together. The rear entrance door is one of those that unlock when an employee holds his or her access card up to the card reader. As the group single-files through the door, I fall in at the back of the line. The guy ahead of me reaches the door, notices there’s someone behind him, takes a quick glance to make sure I’m wearing a company badge, and holds the door open for me. I nod a thanks. This technique is called “tailgating.” Inside, the first thing that catches my eye is a sign posted so you see it immediately as you walk in the door. It’s a security poster, warning not to hold the door for any other person but to require that each person gain entrance by holding up his card to the reader. But common courtesy, everyday politeness to a “fellow employee,” means that the warning on the security poster is routinely ignored. Inside the building, I begin walking corridors with the stride of someone en route to an important task. In fact I’m on a voyage of exploration, looking for the offices of the Information Technology (IT) Department, which after about ten minutes I find in an area on the western side of the building. I’ve done my homework in advance and have the name of one of the company’s network engineers; I figure he’s likely to have full administrator rights to the company’s network. Damn! When I find his workspace, it’s not an easily accessible cubicle but a separate office… behind a locked door. But I see a solution. The ceiling is made up of those white soundproofing squares, the kind often used to create a dropped ceiling with a crawl space above for piping, electrical lines, air vents, and so on. I cell-phone to my buddy that I need him, and make my way back to the rear entrance to let him in. Lanky and thin, he will, I hope, be able to do what I can’t. Back in IT, he clambers onto a desk. I grab him around the legs and boost him up high enough that he’s able to raise one of the tiles and slide it out of the way. As I strain to raise him higher, he manages to get a grip on a pipe and pull himself up. Within a minute, I hear him drop down inside the locked office. The doorknob turns and he stands there, covered in dust but grinning brightly. I enter and quietly close the door. We’re safer now, much less likely to be noticed. The office is dark. Turning on a light would be dangerous but it isn’t necessary—the glow from the engineer’s computer is enough for me to see everything I need, reducing the risk. I take a quick scan of his desk and check the top drawer and under the keyboard to see if he has left himself a note with his computer password. No luck. But not a problem. From my fanny pack, I pull out a CD with a bootable version of the Linux operating system that contains a hacker toolkit and pop it into his CD drive, then restart the computer. One of the tools allows me to change the local administrator’s password on his computer; I change it to something I know, so I can log in. I then remove my CD and again restart the computer, this time logging in to the local administrator account. Working as fast as I can, I install a “remote access Trojan,” a type of malicious software that gives me full access to the system, so I can log keystrokes, grab password hashes, and even instruct the webcam to take pictures of the person using the computer. The particular Trojan I’ve installed will initiate an Internet connection to another system under my control every few minutes, enabling me to gain full control of the victim’s system. Almost finished, as a last step I go into the registry of his computer and set “last logged-in user” to the engineer’s username so there won’t be any evidence of my entry into the local administrator account. In the morning, the engineer may notice that he’s logged out. No problem: as soon as he logs back in, everything will look just as it should. I’m ready to leave. By now my buddy has replaced the overhead tiles. On the way out, I reset the lock. The next morning, the engineer turns on his computer at about 8:30 a.m., and it establishes a connection to my laptop. Because the Trojan is running under his account, I have full domain administrator privileges, and it takes me only a few seconds to identify the domain controller that contains all the account passwords for the entire company. A hacker tool called “fgdump” allows me to dump the hashed (meaning scrambled) passwords for every user. Within a few hours, I have run the list of hashes through “rainbow tables”—a huge database of precomputed password hashes—recovering the passwords of most of the company’s employees. I eventually find one of the back-end computer servers that process customer transactions but discover the credit card numbers are encrypted. Not a problem: I find the key used to encrypt the card numbers is conveniently hidden in a stored procedure within the database on a computer known as the “SQL server,” accessible to any database administrator. Millions and millions of credit card numbers. I can make purchases all day long using a different credit card each time, and never run out of numbers. But I made no purchases. This true story is not a new replay of the hacking that landed me in a lot of hot water. Instead it was something I was hired to do. It’s what we call a “pen test,” short for “penetration test,” and it’s a large part of what my life consists of these days. I have hacked into some of the largest companies on the planet and penetrated the most resilient computer systems ever developed—hired by the companies themselves, to help them close the gaps and improve their security so they don’t become the next hacking victim. I’m largely self-taught and have spent years studying methods, tactics, and strategies used to circumvent computer security, and to learn more about how computer systems and telecommunication systems work. My passion for technology and fascination with it have taken me down a bumpy road. My hacking escapades ended up costing me over five years of my life in prison and causing my loved ones tremendous heartache. Here is my story, every detail as accurate as I can make it from memory, personal notes, public court records, documents obtained through the Freedom of Information Act, FBI wiretap and body-wire recordings, many hours of interviews, and discussions with two government informants. This is the story of how I became the world’s most wanted computer hacker. PART ONE The Making of a Hacker Rough Start Yjcv ku vjg pcog qh vjg uauvgo wugf da jco qrgtcvqtu vq ocmg htgg rjqpg ecnnu? M y instinct for finding a way around barriers and safeguards began very early. At about age one and a half, I found a way to climb out of my crib, crawl to the child gate at the door, and figure out how to open it. For my mom, it was the first wake-up call for all that was to follow. I grew up as an only child. After my dad left when I was three, my mother, Shelly, and I lived in nice, medium-priced apartments in safe areas of the San Fernando Valley, just over the hill from the city of Los Angeles. My mom supported us with waitressing jobs in one or another of the many delis strung out along Ventura Boulevard, which runs east–west for the length of the valley. My father lived out of state and, though he cared about me, was for the most part only occasionally involved in my life growing up until he moved to Los Angeles when I was thirteen years old. Mom and I moved so often I didn’t have the same chance to make friends as other kids did. I spent my childhood largely involved in solitary, mostly sedentary pursuits. When I was at school, the teachers told my mom that I was in the top 1 percentile in mathematics and spelling, years ahead of my grade. But because I was hyperactive as a child, it was hard for me to sit still. Mom had three husbands and several boyfriends when I was growing up. One abused me, another—who worked in law enforcement— molested me. Unlike some other moms I’ve read about, she never turned a blind eye. From the moment she found out I was being mistreated—or even spoken to in a rough way—the guy was out the door for good. Not that I’m looking for excuses, but I wonder if those abusive men had anything to do with my growing up to a life of defying authority figures. Summers were the best, especially if my mom was working a split shift and had time off in the middle of the day. I loved it when she’d take me swimming at the amazing Santa Monica Beach. She’d lie on the sand, sunning and relaxing, watching me splashing in the waves, getting knocked down and coming up laughing, practicing the swimming I had learned at a YMCA camp that I went to for several summers (and always hated except when they took us all to the beach). I was good at sports as a kid, happy playing Little League, serious enough to enjoy spending spare time at the batting cage. But the passion that set me on a life course began when I was ten. A neighbor who lived in the apartment across from us had a daughter about my age whom I guess I developed a crush on, which she reciprocated by actually dancing naked in front of me. At that age, I was more interested in what her father brought into my life: magic. He was an accomplished magician whose card tricks, coin tricks, and larger effects fascinated me. But there was something else, something more important: I saw how his audiences of one, three, or a roomful found delight in being deceived. Though this was never a conscious thought, the notion that people enjoyed being taken in was a stunning revelation that influenced the course of my life. A magic store just a short bike ride away became my spare-time hangout. Magic was my original doorway into the art of deceiving people. Sometimes instead of riding my bike I’d hop on the bus. One day a couple of years later a bus driver named Bob Arkow noticed I was wearing a T-shirt that said, “CBers Do It on the Air.” He told me he’d just found a Motorola handheld that was a police radio. I thought maybe he could listen in on the police frequencies, which would be very cool. It turned out he was pulling my leg about that, but Bob was an avid ham radio operator, and his enthusiasm for the hobby sparked my interest. He showed me a way to make free telephone calls over the radio, through a service called an “auto patch” provided by some of the hams. Free phone calls! That impressed me no end. I was hooked. After several weeks of sitting in a nighttime classroom, I had learned enough about radio circuits and ham radio regulations to pass the written exam, and mastered enough Morse code to meet that qualification as well. Soon the mailman brought an envelope from the Federal Communications Commission with my ham radio license, something not many kids in their early teens have ever had. I felt a huge sense of accomplishment. Fooling people with magic was cool. But learning how the phone system worked was fascinating. I wanted to learn everything about how the phone company worked. I wanted to master its inner workings. I had been getting very good grades all the way through elementary school and in junior high, but around eighth or ninth grade I started cutting classes to hang out at Henry Radio, a ham radio store in West Los Angeles, reading books for hours on radio theory. To me, it was as good as a visit to Disneyland. Ham radio also offered some opportunities for helping out in the community. For a time I worked as a volunteer on occasional weekends to provide communications support for the local Red Cross chapter. One summer I spent a week doing the same for the Special Olympics. Riding the buses was for me a bit like being on holiday—taking in the sights of the city, even when they were familiar ones. This was Southern California, so the weather was almost always near perfect, except when the smog settled in—much worse in those times than today. The bus cost twenty-five cents, plus ten cents for a transfer. On summer vacation when my mom was at work, I’d sometimes ride the bus all day. By the time I was twelve, my mind was already running in devious channels. One day it occurred to me, If I could punch my own transfers, the bus rides wouldn’t cost anything. My father and my uncles were all salesmen with the gift of gab. I guess I share the gene that gave me my ability from very early on to talk people into doing things for me. I walked to the front of the bus and sat down in the closest seat to the driver. When he stopped at a light, I said, “I’m working on a school project and I need to punch interesting shapes on pieces of cardboard. The punch you use on the transfers would be great for me. Is there someplace I can buy one?” I didn’t think he’d believe it because it sounded so stupid. I guess the idea never crossed his mind that a kid my age might be manipulating him. He told me the name of the store, and I called and found out they sold the punches for $15. When you were twelve, could you come up with a reasonable excuse you might have given your mother about why you needed $15? I had no trouble. The very next day I was in the store buying a punch. But that was only Step One. How was I going to get books of blank transfers? Well, where did the buses get washed? I walked over to the nearby bus depot, spotted a big Dumpster in the area where the buses were cleaned, pulled myself up, and looked in. Jackpot! I stuffed my pockets with partially used books of transfers—my first of what would be many, many acts of what came to be called “Dumpster- diving.” My memory has always been way better than average and I managed to memorize the bus schedules for most of the San Fernando Valley. I started to roam by bus everywhere the bus system covered—Los Angeles County, Riverside County, San Bernardino County. I enjoyed seeing all those different places, taking in the world around me. In my travels, I made friends with a kid named Richard Williams, who was doing the same thing, but with two pretty major differences. For one thing, his free-roaming travels were legal because, as the son of a bus driver, Richard rode for free. The second aspect that separated us (initially, anyway) was our difference in weight: Richard was obese and wanted to stop at Jack in the Box for a Super Taco five or six times a day. Almost at once I adopted his eating habits and began growing around the middle. It wasn’t long before a pigtailed blond girl on the school bus told me, “You’re kinda cute, but you’re fat. You oughta lose some weight.” Did I take her sharp but unquestionably constructive advice to heart? Nope. Did I get into trouble for Dumpster-diving for those bus transfers and riding for free? Again, no. My mom thought it was clever, my dad thought it showed initiative, and bus drivers who knew I was punching my own transfers thought it was a big laugh. It was as though everyone who knew what I was up to was giving me attaboys. In fact, I didn’t need other people’s praise for my misdeeds to lead me into more trouble. Who would have thought that a little shopping trip could provide a lesson that would set my life on a new course… in an unfortunate direction?